CVE-2024-21838

5.4 mediumEPSS 0.3%

Medium (5.4) in gallagher command centre. EPSS 0.3% chance of exploitation in the next 30 days.

Improper neutralization of special elements in output (CWE-74) used by the email generation feature of the Command Centre Server could lead to HTML code injection in emails generated by Command Centre. This issue affects: Gallagher Command Centre 9.00 prior to vEL9.00.1774 (MR2), 8.90 prior to vEL8.90.1751 (MR3), 8.80 prior to vEL8.80.1526 (MR4), 8.70 prior to vEL8.70.2526 (MR6), all version of 8.60 and prior.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-10-31)
CWEs: CWE-79, CWE-74
Published: 2024-03-05
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

gallagher:command_centre

References

https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-21838
https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-21838

Check your stack JSON